CVE-2021-46628 : Security Advisory and Response

A vulnerability in Bentley View version 10.15.0.75 could allow remote attackers to disclose sensitive information and execute arbitrary code.

Understanding CVE-2021-46628

This CVE involves a specific flaw in BMP image parsing in Bentley View 10.15.0.75, allowing attackers to read past allocated buffers.

What is CVE-2021-46628?

The vulnerability enables remote attackers to extract sensitive data from affected Bentley View installations by exploiting a parsing flaw in BMP images.

The Impact of CVE-2021-46628

CVSS Score: 3.3 (Low)
Attack Vector: Local
User Interaction: Required
Confidentiality Impact: Low
Integrity Impact: None
This vulnerability could be leveraged to execute arbitrary code in the current process context.

Technical Details of CVE-2021-46628

The vulnerability's technical aspects and affected systems.

Vulnerability Description

The issue lacks proper validation of user-supplied data in BMP image parsing.
It can lead to reading beyond allocated buffers, potentially resulting in sensitive data exposure.

Affected Systems and Versions

Product: Bentley View
Version: 10.15.0.75

Exploitation Mechanism

User interaction is necessary; victims must access a malicious page or open a harmful file.

Mitigation and Prevention

Protective measures and steps to mitigate the CVE.

Immediate Steps to Take

Update Bentley View to the latest version.
Avoid interacting with unknown or suspicious files or websites.
Implement security solutions to detect and prevent similar attacks.

Long-Term Security Practices

Regularly monitor for security updates and patches.
Conduct security training to educate users on safe computing practices.

Patching and Updates

Apply security patches promptly to address known vulnerabilities.